Each PHP release announcement for 8.5.12, 8.4.27, 8.3.36, and 8.2.35 says Windows source and binaries are on the PHP downloads page. Those are the Windows builds this site will call fixed. Older Windows zips for 8.1, 8.0, and 7.4 are not those releases. The source backports exist for 7.4, 8.0, and 8.1 and are not published as a new Windows version number in the announcement.
IIS with PHP commonly uses FastCGI. The handler mapping decides which php-cgi.exe runs. Update the directory that mapping points at, then recycle the IIS application pool so the old CGI process exits. A new php.exe on PATH is not the handler until the mapping says so.
If you use the PHP Manager or a manual scriptProcessor path, write the path down before you replace files, and keep the old directory until a test request succeeds. Extension DLLs have to match the new build. A missing php_curl.dll style error in the log means the site is down, not that the CVE remains.
There is no Windows equivalent of a silent Ubuntu backport in the PHP announcements. If phpinfo or the CGI binary prints 8.3.30, you are below 8.3.36. Move to the published zip for that branch or a newer fixed branch the application supports.